CVE-2024-54436 Overview
CVE-2024-54436 is a Cross-Site Request Forgery (CSRF) vulnerability in the milordk Jet Footer Code (jet-footer-code) plugin for WordPress. The flaw affects all versions up to and including 1.4. An attacker can chain the CSRF weakness with a Stored Cross-Site Scripting (XSS) payload, allowing injected JavaScript to persist in plugin-controlled footer code. Successful exploitation requires an authenticated administrator to interact with a crafted request, typically by visiting an attacker-controlled page while logged in. The vulnerability is tracked under CWE-352 and carries a CVSS 3.1 base score of 7.1.
Critical Impact
A successful CSRF-to-Stored-XSS chain enables persistent script execution in the WordPress administrator context, leading to session theft, account takeover, and full site compromise.
Affected Products
- milordk Jet Footer Code WordPress plugin (jet-footer-code)
- All versions from initial release through 1.4
- WordPress sites with the plugin installed and activated
Discovery Timeline
- 2024-12-16 - CVE-2024-54436 published to the National Vulnerability Database
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2024-54436
Vulnerability Analysis
The Jet Footer Code plugin lets administrators inject custom code into the WordPress site footer. The administrative endpoint that saves footer code does not validate a CSRF token (WordPress nonce) on incoming state-changing requests. An attacker who can lure an authenticated administrator to a malicious page can force the browser to submit a forged save request. Because the plugin also fails to sanitize the saved footer content, the attacker can persist arbitrary JavaScript into the site footer. The injected script then executes in every visitor's browser, including other administrators.
Root Cause
The root cause is missing or improperly verified CSRF protection on the plugin's settings save handler. WordPress provides the wp_nonce_field() and check_admin_referer() primitives to defend against forged requests. The vulnerable code path does not enforce these checks, satisfying the conditions described in CWE-352. Combined with insufficient output encoding of footer code values, the missing nonce check escalates a CSRF flaw into a Stored XSS sink.
Attack Vector
The attack requires network access to the target WordPress site and victim interaction. An attacker hosts a page containing an auto-submitting HTML form or fetch request targeting the plugin's settings endpoint. When a logged-in WordPress administrator visits the page, the browser sends authenticated cookies along with the forged request. The plugin accepts the request and stores the attacker-controlled JavaScript. The payload then runs in the context of every subsequent page view that includes the footer.
No public proof-of-concept code is referenced in the advisory. See the Patchstack Vulnerability Report for additional technical context.
Detection Methods for CVE-2024-54436
Indicators of Compromise
- Unexpected <script> tags, iframes, or obfuscated JavaScript appearing in the site footer rendered on public pages.
- Modifications to jet-footer-code plugin options in the wp_options table that were not initiated by a known administrator.
- Outbound requests from visitor browsers to unfamiliar third-party domains originating from footer-injected scripts.
- Administrator session activity originating from referrer URLs outside the WordPress admin domain.
Detection Strategies
- Monitor WordPress audit logs for changes to Jet Footer Code settings without a corresponding administrator-initiated workflow.
- Compare rendered HTML of public pages against a known-good baseline to detect injected script content in footer regions.
- Inspect HTTP POST requests to plugin admin endpoints for missing or invalid _wpnonce parameters.
Monitoring Recommendations
- Enable a WordPress activity logging plugin to record option and plugin setting changes with user attribution.
- Forward web server access logs to a centralized log platform and alert on POST requests to wp-admin endpoints lacking expected referrer headers.
- Deploy a Content Security Policy (CSP) and alert on report-only violations that indicate unexpected inline script execution.
How to Mitigate CVE-2024-54436
Immediate Actions Required
- Update the Jet Footer Code plugin to a version newer than 1.4 once the vendor publishes a fix, or deactivate and remove the plugin if no patch is available.
- Audit the current footer code content stored by the plugin and remove any unrecognized script blocks.
- Force a password reset and session invalidation for all WordPress administrator accounts if injected content is detected.
Patch Information
The Patchstack advisory lists affected versions as <= 1.4. Site operators should consult the Patchstack Vulnerability Report and the plugin's official distribution channel for the latest fixed release. If no vendor patch exists, treat the plugin as unmaintained and replace it with an actively supported alternative.
Workarounds
- Deactivate and uninstall the jet-footer-code plugin until a patched version is verified.
- Restrict access to the WordPress administrative interface using IP allowlists or a Web Application Firewall (WAF) rule that requires same-origin referrers on settings endpoints.
- Apply a strict Content Security Policy that disallows inline scripts to limit the impact of any stored XSS payload.
- Require administrators to use separate browser profiles or sessions when performing privileged tasks to reduce CSRF exposure.
# Disable the vulnerable plugin via WP-CLI until a patch is applied
wp plugin deactivate jet-footer-code
wp plugin delete jet-footer-code
# Audit stored footer code option for unexpected script content
wp option get jet_footer_code_settings
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
